France Says Iran Hacked Its Supermarket Fridges. What Did the Hackers Leave Behind?

On November 9, France accused Iran’s Islamic Revolutionary Guard Corps, a branch of the Iranian military, of ordering a cyberattack that interfered with supermarket refrigeration across France. The hackers turned equipment meant to keep food cold into a source of heat. France named the unit it believes carried out the attack, opened a judicial investigation and called for European sanctions. Its public report lays out the clues behind the accusation.

What happened in the supermarkets?

Overnight on October 11–12, attackers changed the defrost settings on refrigeration equipment at French businesses. The report puts the number of retail sites targeted at about 700. Affected businesses included stores from chains such as Carrefour and Intermarché, as well as smaller butchers, a slaughterhouse and food-processing plants. Businesses lost stock and the French report counted at least 15 cases in which fires broke out.

How do you make a fridge heat up from a distance?

You get into the controller, the computer that tells the cooling equipment what to do. Refrigeration systems periodically warm part of the equipment to melt built-up ice. Technicians can adjust those defrost settings remotely. France says the attackers set them to unusually high temperatures.

The appeal of remote maintenance is easy to see. A technician can check several stores from one desk. The security problem starts when a control panel can be reached from the public internet. France’s cyber agency documented compromised controllers from several manufacturers. Independent security researchers at Claroty also found ways to access certain Danfoss controllers in their own tests. Those tests show what was possible. The French report leaves the exact route into each affected site open.

Who does France say did it?

France names Shahid Kaveh, a cyber unit within the Revolutionary Guards’ electronic and cyber command. Its report says the unit uses several public identities, including CyberAv3ngers, to claim some operations. The Paris prosecutor announced a judicial investigation involving the unit’s leadership and said prosecutors had sought international arrest warrants. Reuters reported that Iran’s mission to the UN had yet to reply to its requests for comment.

What clues led investigators to that unit?

The French case rests in part on overlapping activity. Investigators say the same online infrastructure used in the fridge attack was also used around the same time to look for industrial equipment made by Schneider Electric. Investigators recognised methods they had already associated with Shahid Kaveh. They also found traces of Farsi, identified a tool used to search for internet-connected devices, and said a channel linked to the unit publicised the attack on October 13. The prosecutor cited internet addresses pointing to devices in Iran.

An internet address can point to a machine through which an attacker routed traffic. Investigators have to work out who was using that machine. Language, tools and online claims can provide clues. The weight of France’s public case lies in how those clues fit together. The report sets out the government’s assessment while the investigation continues.

Why would a military cyber unit target supermarkets?

France describes the operation as sabotage intended to cause disruption. The same report links the attackers to targeting equipment at small French hydroelectric installations, where it says the effects were limited. A supermarket shows how the disruption can spread. A command sent remotely can affect many sites and leave staff dealing with ruined stock, damaged equipment or a fire. The public findings leave open why these specific targets were chosen.

Were the November fridge hacks also Iran’s work?

That link remains open. The French report’s fridge attribution concerns October 11–12. A later wave hit more than 100 establishments across Europe in November. Refrigeration systems used by French blood banks were also affected, and staff moved some blood supplies into other cold storage. US investigators are examining separate freezer failures at military-base grocery stores that began in August. Reuters could establish no link among the three episodes.

Where else have hackers disrupted physical operations?

US water, 2023. The water authority in Aliquippa, Pennsylvania, took an affected controller offline and switched to manual operations. US cyber agencies tied a wider campaign against this kind of equipment to an IRGC-linked group using the CyberAv3ngers name. The US later sanctioned officials including Hamid Reza Lashgarian and Mahdi Lashgarian, both named in France’s new report.

Australian sewage, 2000. In Queensland, false radio messages interfered with sewage pumps. Raw sewage escaped from an overflowing station. Police found a laptop, a controller and radio equipment in former contractor employee Vitek Boden’s car. The controller was set to impersonate a pump station whose identity had been used in the intrusion. An appeals court overturned some of his convictions and left others standing.

European wind power, 2022. The attack on Viasat’s satellite network knocked out remote monitoring and control for about 5,800 Enercon turbines in central Europe. The turbines continued generating automatically. The EU publicly blamed Russia for the satellite attack. Here, a strike on the communications link left operators without their usual way to see and control machines that kept running.

Japan’s Port of Nagoya, 2023. Ransomware, software that can lock computer systems until a ransom is paid, hit the platform that coordinated containers across the port. Japan’s transport ministry says containers stopped moving in and out of its terminals for about three days. The attack interrupted the software that organised the work.

What does this mean for India’s cold chains?

India’s Electronic Vaccine Intelligence Network uses connected sensors to monitor temperatures in vaccine stores. Monitoring can help staff spot a temperature rise quickly. A system that can also send commands to refrigeration equipment gives someone with access a different kind of power. The practical questions for any cold-chain operator are who can change settings, whether staff can check temperatures independently, and how the equipment can be run safely if remote access has to be cut.

Could France’s accusation lead to EU sanctions?

France summoned Iran’s ambassador and Foreign Minister Jean-Noël Barrot called for European sanctions. The EU has a framework that can impose travel bans and asset freezes on people or organisations involved in significant cyberattacks. France has now named a unit and prosecutors have sought warrants. The next decisions are whether the warrants are issued and whether the EU adopts measures tied to this case.